Latombe v. Commission: The Court Case That Could Kill the EU-US Data Privacy Framework

Last updated: June 2026. This article tracks a live case and is updated as it develops.

If the EU-US Data Privacy Framework falls, it will probably fall in a courtroom in Luxembourg, and the case to watch is Latombe v. Commission. It is the legal vehicle most likely to produce the ruling the industry has pre-named "Schrems III" ↗, and it is currently sitting in front of the EU's highest court.

Here is the whole story in plain language: who is suing, what he argues, what the first court said, and what the appeal can actually change for anyone running analytics or marketing tools on EU traffic.

Who is Philippe Latombe?

A French member of parliament (MoDem party) and a longtime digital sovereignty advocate, with a background in data protection law. Unlike Max Schrems, who attacked the previous frameworks through complaints against Facebook that wound their way up through national courts, Latombe went straight at the target: in September 2023, two months after the European Commission adopted the DPF adequacy decision, he filed a direct annulment action against it before the EU General Court (case T-553/23).

That procedural choice matters. A direct action is faster than the Schrems route (no years of national proceedings first) but harder to win standing for, and it frames the question purely as: did the Commission act lawfully when it declared the US "adequate" for EU personal data?

What he argued

Latombe's challenge attacked the DPF on both procedure and substance. The recurring core arguments:

1. The redress mechanism is not a real court. The DPF's centerpiece fix for the defects identified in Schrems II is the Data Protection Review Court, the US body where EU citizens can challenge surveillance of their data. Latombe argued the DPRC is not independent or impartial in the way EU law requires: it sits inside the US executive branch, its existence rests on an executive order that any US administration can amend, and its procedures keep the complainant in the dark.
2. US bulk data collection remains disproportionate. The same fundamental objection that killed Safe Harbor and Privacy Shield: US intelligence agencies' bulk collection practices are incompatible with EU proportionality requirements, and an adequacy decision cannot paper over that.
3. Procedural defects. Including the argument that the decision was published in English only, without translations into the EU's official languages at adoption.

If argument 1 or 2 prevails, the consequences are not cosmetic: they are the same class of defect that produced full invalidation twice before.

What the General Court decided (September 2025)

The General Court dismissed the action and upheld the DPF. In substance, the court found that the DPRC, as constructed with its post-Schrems II safeguards, provides sufficient guarantees of independence and redress, and that the Commission stayed within its margin of assessment in finding US protection "essentially equivalent" to EU standards.

Round one to the Data Privacy Framework: its first judicial test, survived.

Two reasons that is not the end of the story. First, the General Court is the EU's lower court; the Court of Justice (CJEU) above it is the court that struck down Safe Harbor and Privacy Shield, both times overturning more permissive readings from below. Second, the General Court's reasoning leans on the current state of US executive orders, and executive orders are exactly as durable as the next administration wants them to be. The factual ground under the judgment can shift without any court moving.

The appeal: Case C-703/25 P

Latombe appealed to the CJEU on October 31, 2025. The case is registered as C-703/25 P. As of May 2026, no hearing date has been announced.

What an appeal can and cannot do: the CJEU reviews points of law, not facts, so the fight will be over whether the General Court applied the right legal standard for independence, redress and proportionality. That is precisely the terrain where the CJEU has historically been the strictest, in both Schrems judgments.

Realistic timeline, based on typical CJEU appeal durations of 1.5 to 2.5 years: a decision plausibly lands in 2027, possibly 2028.

And there is a second front forming: noyb, Max Schrems' organization, stated after the General Court ruling that it is considering its own, broader challenge to the DPF, which would run on a separate clock with the Schrems track record behind it. We track every active challenge on one page ↗.

What it means for your analytics stack

Nothing changes today: the DPF is valid, and transfers under it (including Google Analytics) are lawful. What the case defines is the risk horizon:

• If the appeal succeeds, the DPF goes the way of Safe Harbor and Privacy Shield, with no transition period, and the 2022 enforcement playbook against US analytics tools reactivates with the templates already written ↗.
• The cheap insurance is the same regardless of outcome: know your US data flows, keep your historical data exportable, and prefer tools where the question is irrelevant because no personal data leaves EU-owned infrastructure ↗. That preparation costs little and also removes cookie banner friction today.

Full disclosure of our angle: Datalenk is built and hosted in the EU precisely so that the outcome of C-703/25 P does not matter to our users. We would write this tracker anyway; the case is the most consequential thing happening to web analytics law right now.

FAQ

What is Latombe v. Commission? A direct legal challenge to the EU-US Data Privacy Framework filed by French MP Philippe Latombe in September 2023 (T-553/23). The EU General Court dismissed it in September 2025 and upheld the DPF; Latombe appealed to the CJEU on October 31, 2025 (C-703/25 P).

Did the court find the Data Privacy Framework valid? The General Court did, in September 2025. The appeal before the Court of Justice, the court that invalidated both previous frameworks, is pending.

When will the CJEU rule? No hearing date is set as of mid-2026. Typical appeal timelines point to 2027-2028.

Is this the same thing as Schrems III? "Schrems III" is the industry nickname for whatever ruling next decides the DPF's fate. The Latombe appeal is currently the leading candidate; a separate noyb challenge, if filed, would be the other.

Should I stop using Google Analytics because of this case? Not on legal grounds today. But the case is the formal measure of a real risk, and sites that prepared before the 2020 and 2022 rulings had a much cheaper transition than sites that scrambled after.